{"record":{"id":"dea4fcb1662d9a40","repo":"can1357/oh-my-pi","slug":"unknown-security-finding-findingid-dea4fc","errorCode":null,"errorMessage":"Unknown security finding: ${findingId}","messagePattern":"Unknown security finding: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/coding-agent/src/security/store.ts","lineNumber":370,"sourceCode":"\t\t}\n\t\treturn summaries;\n\t}\n\n\tasync getFinding(scanId: string, findingId: string): Promise<SecurityFinding | null> {\n\t\tconst bundle = await this.getBundle(scanId);\n\t\treturn bundle?.findings.find(finding => finding.id === findingId) ?? null;\n\t}\n\n\tasync updateDisposition(\n\t\tscanId: string,\n\t\tfindingId: string,\n\t\tdisposition: SecurityDisposition,\n\t): Promise<SecurityFinding> {\n\t\treturn withSecurityStoreWrite(this.#projectDirectory, async () => {\n\t\t\tconst bundle = await this.#getBundleUnlocked(scanId);\n\t\t\tif (!bundle) throw new Error(`Unknown security scan: ${scanId}`);\n\t\t\tconst index = bundle.findings.findIndex(finding => finding.id === findingId);\n\t\t\tif (index < 0) throw new Error(`Unknown security finding: ${findingId}`);\n\t\t\tconst canonicalDisposition: SecurityDisposition = { status: disposition.status };\n\t\t\tif (disposition.rationale !== undefined) canonicalDisposition.rationale = disposition.rationale;\n\t\t\tif (disposition.updatedAt !== undefined) canonicalDisposition.updatedAt = disposition.updatedAt;\n\t\t\tif (disposition.actor !== undefined) canonicalDisposition.actor = disposition.actor;\n\t\t\tconst updated = { ...bundle.findings[index], disposition: canonicalDisposition };\n\t\t\tbundle.findings[index] = parseSecurityFinding(updated);\n\t\t\tif (bundle.sarif !== undefined) bundle.sarif = exportSecurityBundleToSarif(bundle);\n\t\t\tawait this.#putBundleUnlocked(bundle);\n\t\t\treturn bundle.findings[index];\n\t\t});\n\t}\n\n\tasync updateValidation(\n\t\tscanId: string,\n\t\tfindingId: string,\n\t\tvalidation: SecurityValidation,\n\t\tevidence: readonly SecurityEvidence[] = [],\n\t): Promise<SecurityFinding> {","sourceCodeStart":352,"sourceCodeEnd":388,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/coding-agent/src/security/store.ts#L352-L388","documentation":"updateDisposition() locates the finding by id inside the loaded bundle's findings array. If no finding matches findingId it throws this error. The scan exists (otherwise error 2014 fires first); only the finding id is wrong.","triggerScenarios":"Calling updateDisposition(scanId, findingId, disposition) where findingId is not present in that scan's findings — typo'd/copied-wrong id, the finding belongs to a different scan, or the finding was removed when the bundle was rewritten.","commonSituations":"Using a finding id from an older scan generation in a re-scanned bundle; id copied from a SARIF export with a different id scheme; truncation when copying ids; referencing a finding from the 'after' scan in compare() workflows.","solutions":["Look up valid ids first: (await store.getBundle(scanId))?.findings.map(f => f.id) and use an exact match.","Use store.getFinding(scanId, findingId) to test existence before calling updateDisposition.","Confirm the finding belongs to this scanId, not a sibling scan in the same store.","If the finding was legitimately removed, decide whether the disposition is still meaningful — otherwise skip or re-run the scan."],"exampleFix":"// before\nawait store.updateDisposition(scanId, 'finding-1', disposition); // wrong id scheme\n// after\nconst finding = await store.getFinding(scanId, 'finding-1');\nif (!finding) throw new Error('finding not in this scan');\nawait store.updateDisposition(scanId, finding.id, disposition);","handlingStrategy":"type-guard","validationCode":"const finding = await store.getFinding(scanId, findingId);\nif (!finding) throw new Error(`finding ${findingId} not in scan ${scanId}`);","typeGuard":"function isKnownFinding(f: SecurityFinding | null): f is SecurityFinding {\n  return f !== null;\n}","tryCatchPattern":"try {\n  await store.updateDisposition(scanId, findingId, disposition);\n} catch (err) {\n  if (err instanceof Error && err.message.startsWith('Unknown security finding')) {\n    const bundle = await store.getBundle(scanId);\n    console.error(`valid ids: ${bundle?.findings.map(f => f.id).join(', ')}`);\n  } else throw err;\n}","preventionTips":["Always source finding ids from the same bundle/scan you pass as scanId.","Call getFinding() to verify existence before mutation.","Refresh ids after re-scans; old generation ids may disappear.","Watch for id truncation when copying from terminal output or logs."],"tags":["security-store","not-found","finding-id"],"backgroundTag":"resource-not-found","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}